1009-00007 · Skybridge Fintech Ltd · Memos & Analysis

regulatory-compliance-memo.docx DOCUMENT Funds

17 / 35 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP REGULATORY COMPLIANCE MEMORANDUM

TO: Amy Chesterton, Lead Associate; Angela Fontaine, Responsible Partner; Liam Prescott, Of Counsel

FROM: Nathan Ikeda, Working Associate

DATE: September 12, 2025

RE: Regulatory Compliance Analysis — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement (SkyComply™)

MATTER NO.: 1009-00007

STATUS: PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

Right-click to update Table of Contents

I. EXECUTIVE SUMMARY

The purpose of this memorandum is to analyze the regulatory framework applicable to Skybridge Fintech Ltd. ("Skybridge" or "SBF") as a technology service provider to Meridian National Bank, N.A. ("Meridian" or "MNB"), a national banking association chartered by the Office of the Comptroller of the Currency ("OCC") and further regulated by the Board of Governors of the Federal Reserve System (the "Federal Reserve") and the Federal Deposit Insurance Corporation (the "FDIC"). Meridian is a systemically important financial institution ("SIFI") with approximately $485 billion in total consolidated assets as of the most recently reported fiscal quarter, placing it well above the enhanced prudential standards thresholds established under Section 165 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, as amended. By virtue of its SIFI designation and the scope of its operations, Meridian is subject to heightened regulatory expectations across all dimensions of its risk management framework, including the management of third-party relationships.

Skybridge and Meridian are currently engaged in negotiations for a five-year enterprise Master Software-as-a-Service Agreement (the "MSA") covering the licensing, deployment, implementation, hosting, and ongoing support of SkyComply™, Skybridge's proprietary AI-driven anti-money-laundering and transaction-monitoring platform. The total contract value ("TCV") of the proposed engagement is approximately $50,000,000 over the initial five-year term, corresponding to an annual contract value ("ACV") of approximately $9,325,000 (inclusive of base license fees, implementation services, and managed support). The SkyComply™ platform is to be deployed across approximately 32,000 licensed users spanning Meridian's retail banking, commercial banking, and wealth management divisions. Given the scope and criticality of this deployment, the MSA represents one of the largest single-vendor technology engagements in Meridian's current procurement pipeline.

Meridian's holding company, Meridian Financial Group, Inc. ("MFG"), is a publicly traded bank holding company listed on the New York Stock Exchange. MFG is subject to Federal Reserve supervision and consolidated regulation, including capital planning, stress testing, and resolution planning requirements applicable to large banking organizations.

Skybridge is organized as a Delaware limited liability company (alternative entity structure) and is majority-owned — holding approximately 62% of the outstanding membership interests — by Pinnacle Ridge Capital Partners, LP, a Delaware limited partnership. Pinnacle Ridge is a mid-market private equity fund focused on financial technology and enterprise software investments. The remaining equity interests in Skybridge are held by its founders and certain members of the senior management team. Skybridge currently serves over 60 banking and financial services clients and holds current SOC 2 Type II and ISO 27001 certifications, as discussed in further detail below.

This memorandum identifies the key regulatory requirements that will shape the contractual provisions to be included in the MSA, specifically:

1. OCC Bulletin 2013-29, titled "Third-Party Relationships: Risk Management Guidance," which sets forth the OCC's supervisory expectations for national banks in managing risks associated with third-party relationships, including technology service providers;

2. The Interagency Guidance on Third-Party Relationships: Risk Management, jointly issued by the OCC, the Federal Reserve, and the FDIC in June 2023, which provides updated, consolidated guidance applicable to all supervised banking organizations;

3. The Bank Service Company Act, codified at 12 U.S.C. § 1861 et seq. (with particular emphasis on § 1867(c)), which grants federal banking regulators independent statutory authority to examine the operations of technology service providers that furnish services to insured depository institutions; and

4. BSA/AML regulatory considerations specific to the SkyComply™ platform, including the platform's role in supporting Meridian's compliance with the Bank Secrecy Act ("BSA"), as amended by the USA PATRIOT Act and the Anti-Money Laundering Act of 2020, and their implementing regulations, including the regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN") and the examination standards set forth in the Federal Financial Institutions Examination Council ("FFIEC") BSA/AML Examination Manual.

Recommended contract language for inclusion in the MSA is provided in Section V of this memorandum, and a consolidated summary of recommendations is set forth in Section VI. This memorandum should be read in conjunction with the related work product identified in Section VII, including the Indemnification and Liability Cap Analysis Memorandum, the Data Security and Privacy Requirements Memorandum, and the Insurance Coverage Gap Analysis Memorandum, each of which addresses specific aspects of the MSA in greater detail.

II. REGULATORY FRAMEWORK OVERVIEW

A. OCC Bulletin 2013-29: Third-Party Relationships — Risk Management Guidance

OCC Bulletin 2013-29, issued by the Office of the Comptroller of the Currency on October 30, 2013, establishes the OCC's comprehensive expectations for national banks and federal savings associations in managing the risks associated with third-party relationships. The Bulletin was issued against a backdrop of increasing reliance by banking organizations on external service providers for a wide range of operational, technological, and compliance-related functions, and it reflects the OCC's recognition that a bank's use of third parties does not diminish the bank's obligation to operate in a safe and sound manner and in compliance with applicable law.

Definition of "Third-Party Relationship." OCC Bulletin 2013-29 defines "third-party relationship" broadly to encompass "any business arrangement between a bank and another entity, by contract or otherwise." This definition is intentionally expansive and is not limited to traditional outsourcing arrangements. It specifically encompasses technology service providers, software-as-a-service vendors, cloud computing providers, data processors, payment processors, and any other entity that provides products or services to or on behalf of the bank. Under this definition, the proposed engagement between Meridian and Skybridge for the SkyComply™ platform clearly constitutes a third-party relationship subject to the Bulletin's requirements. There is no ambiguity on this point: Skybridge is an external technology service provider delivering a hosted software platform to a national bank, and the relationship is governed by a written contract (the MSA).

Classification of Relationships — "Critical Activities." The Bulletin classifies third-party relationships based on the criticality of the activities performed by the third party. Relationships involving "critical activities" are subject to the most rigorous risk management expectations. The Bulletin defines critical activities as those that:

• Could cause a bank to face significant risk if the third party fails to meet expectations;

• Have significant customer impacts;

• Require significant investment in resources to implement the activity or to transition the activity to another third party;

• Could have a major impact on bank operations if the bank needs to find an alternate third party or if the outsourced activity has to be brought in-house; or

• Involve services that the bank relies upon to comply with applicable laws and regulations.

The proposed Skybridge engagement unambiguously constitutes a "critical activity" relationship under these criteria. Specifically:

(a) BSA/AML Compliance Dependency. SkyComply™ directly supports Meridian's compliance with the Bank Secrecy Act and its implementing regulations, which are among the most significant regulatory obligations imposed on national banks. BSA/AML compliance is a core regulatory requirement, and deficiencies in a bank's AML program can result in enforcement actions, civil money penalties, criminal referrals, and reputational harm of the most severe kind. Meridian relies on SkyComply™ as the primary technology platform for transaction monitoring, suspicious activity detection, and related AML compliance functions. Accordingly, the platform falls squarely within the category of services that the bank "relies upon to comply with applicable laws and regulations."

(b) Processing of Non-Public Personal Information and Personally Identifiable Information. The SkyComply™ platform will process substantial volumes of Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. § 6801 et seq., and personally identifiable information ("PII") of Meridian's customers. This data includes transaction records, account information, customer identification data, and potentially sensitive information associated with suspicious activity investigations. The handling of such data implicates significant data security and privacy risks.

(c) Enterprise-Wide Deployment. The platform will be deployed to approximately 32,000 licensed users across all of Meridian's major business lines — retail banking, commercial banking, and wealth management. This enterprise-wide deployment means that the SkyComply™ platform will be deeply embedded in Meridian's operational infrastructure, and any material disruption or failure of the platform would have far-reaching consequences across the entire organization.

(d) Significant Financial Commitment. The total contract value of $50,000,000 over the initial five-year term represents a significant financial commitment by Meridian, further underscoring the critical nature of the relationship.

(e) Regulatory and Reputational Risk. Failure of the AML monitoring platform — whether due to system downtime, inaccurate transaction screening, failure to detect suspicious activity, or data integrity issues — could expose Meridian to enforcement action by the OCC, the Federal Reserve, the FDIC, or FinCEN; regulatory fines and penalties; and reputational harm that could materially affect Meridian's business, customer relationships, and standing in the financial services industry. Given Meridian's SIFI status and the heightened regulatory scrutiny that accompanies that designation, the consequences of a significant AML compliance failure would be particularly severe.

Key OCC Expectations for Critical-Activity Relationships. For third-party relationships involving critical activities, OCC Bulletin 2013-29 establishes the following expectations, each of which is relevant to the structuring and negotiation of the MSA:

• Comprehensive Due Diligence and Third-Party Selection. The bank should conduct thorough due diligence before entering into the relationship, assessing the third party's financial condition, business reputation, qualifications and experience, legal and regulatory compliance record, information security program, business continuity and disaster recovery capabilities, reliance on subcontractors, and insurance coverage. The due diligence process should be commensurate with the level of risk and complexity of the third-party relationship.

• Written Contracts with Specific Required Provisions. The bank should negotiate and execute written contracts that clearly define the rights and responsibilities of all parties. The Bulletin identifies specific provisions that should be included in contracts for critical-activity relationships, including scope of services, performance standards, audit and examination rights, data protection and confidentiality, business continuity and disaster recovery, subcontractor management, indemnification, termination rights, and dispute resolution. These required provisions are discussed in detail in Section IV of this memorandum.

• Ongoing Monitoring. The bank should conduct ongoing monitoring of the third party's performance, financial condition, and compliance with contractual terms and applicable law. Monitoring activities should include regular review of performance against service level agreements, assessment of the third party's financial statements and audit reports, and escalation of material issues to senior management or the board as appropriate.

• Contingency Planning and Exit Strategies. The bank should develop and maintain contingency plans for managing the relationship, including exit strategies that address how the bank would transition services to another provider or bring them in-house in the event of contract termination, third-party failure, or other disruption. The exit strategy should address data migration, transition services, and continuity of critical operations.

• Clear Governance and Escalation Procedures. The bank should establish clear governance structures, including designated relationship managers, regular performance reviews, and escalation procedures for addressing issues that arise during the course of the relationship. For critical-activity relationships, governance expectations are particularly robust and may include steering committees, executive-level oversight, and formal reporting to the board of directors.

• Board or Senior Management Oversight. The bank's board of directors or a designated committee thereof should provide oversight of the bank's third-party risk management program, including review and approval of critical third-party relationships. Senior management should be actively involved in the oversight of individual critical-activity relationships and should report to the board on the status and risks associated with such relationships on a regular basis.

Each of these expectations has direct implications for the structure and content of the MSA, and the recommendations set forth in Sections V and VI of this memorandum are designed to ensure that the MSA satisfies these expectations.

B. Interagency Guidance on Third-Party Relationships (June 2023)

In June 2023, the OCC, the Federal Reserve, and the FDIC jointly issued the Interagency Guidance on Third-Party Relationships: Risk Management (the "Interagency Guidance"). This guidance represents a significant milestone in the harmonization of supervisory expectations across the three principal federal banking agencies. The Interagency Guidance replaces or supplements prior individual agency guidance, including the OCC's Bulletin 2013-29 (which remains in effect for OCC-supervised institutions but is now read in conjunction with the Interagency Guidance), the Federal Reserve's SR 13-19, and the FDIC's Financial Institution Letter FIL-44-2008.

Applicability to Meridian. The Interagency Guidance applies to all banking organizations supervised by the three issuing agencies. Meridian, as a national bank chartered by the OCC, is directly subject to OCC supervision. MFG, as a bank holding company, is supervised by the Federal Reserve at the consolidated level. Meridian is also an FDIC-insured institution. Accordingly, the Interagency Guidance is directly applicable to Meridian's relationship with Skybridge from the perspective of all three agencies.

Alignment with OCC Bulletin 2013-29. The Interagency Guidance mirrors OCC Bulletin 2013-29 in many material respects. It adopts a similar risk-based approach, distinguishing between higher-risk and lower-risk third-party relationships and applying more rigorous expectations to the former. It addresses the same lifecycle stages of the third-party relationship — planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination — and sets forth substantially similar expectations for each stage. However, the Interagency Guidance also provides updated and, in some respects, expanded expectations that reflect the evolution of the third-party risk landscape since 2013, including the increased prevalence of cloud-based and AI-driven technology solutions.

Key Themes Relevant to the Skybridge Engagement. The following themes from the Interagency Guidance are particularly relevant to the negotiation and structuring of the MSA:

• Risk-Based Approach. The Interagency Guidance emphasizes that banking organizations should apply a risk-based approach to the management of third-party relationships, with more rigorous oversight for higher-risk relationships — particularly those involving critical activities. As established above, the Skybridge engagement is a critical-activity relationship by any measure, and Meridian's examiners will expect to see the full complement of risk management practices applied to this engagement.

• Due Diligence Standards. The Interagency Guidance provides detailed expectations for due diligence in connection with critical-activity relationships. Due diligence should assess, among other things, the third party's financial condition and viability, its legal and regulatory compliance history, its information security program and practices, its business continuity and disaster recovery capabilities, its reliance on subcontractors and fourth parties (including, in the case of Skybridge, its use of Orion Cloud Services, Inc. as its infrastructure-as-a-service provider), and the adequacy of its insurance coverage. The due diligence process should be documented and should inform the bank's risk assessment and contracting decisions.

• Contract Negotiation Requirements. The Interagency Guidance identifies specific provisions that banking organizations should seek to include in contracts with third-party service providers, particularly for critical-activity relationships. These provisions are substantially similar to those identified in OCC Bulletin 2013-29 and are discussed in detail in Section IV of this memorandum. Notably, the Interagency Guidance emphasizes that the contract should clearly articulate the bank's expectations and the third party's obligations with respect to audit and examination rights, data protection, incident notification, subcontractor management, business continuity, termination, and dispute resolution.

• Ongoing Monitoring Obligations. The Interagency Guidance requires banking organizations to conduct ongoing monitoring of third-party relationships commensurate with the level of risk. For critical-activity relationships, monitoring should include regular assessment of the third party's performance against agreed-upon service levels, review of audit reports (including SOC 2 Type II reports and ISO 27001 certifications), monitoring of the third party's financial condition, tracking of complaints and performance issues, and escalation of material concerns to senior management and the board. The Interagency Guidance also notes that banking organizations should periodically reassess the risk profile of their third-party relationships and adjust their oversight practices accordingly.

• Governance. The Interagency Guidance places significant emphasis on governance, requiring that the board of directors and senior management of the banking organization maintain appropriate oversight of the bank's third-party risk management program. For critical-activity relationships, this includes regular reporting to the board or a designated committee on the status of the relationship, material risks, and any significant issues that have arisen. The governance structure should include clearly defined roles and responsibilities, escalation procedures, and accountability mechanisms.

C. Bank Service Company Act (12 U.S.C. § 1867)

The Bank Service Company Act ("BSCA"), originally enacted in 1962 and subsequently amended, ensures that federal banking regulators retain full supervisory visibility over services performed for banks, even when those services are performed by entities outside the bank's own corporate structure. The BSCA was enacted in recognition of the fact that banks increasingly rely on external service providers for functions that are integral to banking operations, and that the delegation of these functions to third parties should not create gaps in regulatory oversight.

Statutory Framework. The key operative provision for purposes of the Skybridge engagement is Section 1867(c) of the BSCA, which provides that:

"The performance of [bank] services by [a third party] . . . shall be subject to regulation and examination by the appropriate Federal banking agency to the same extent as if such services were being performed by the [bank] itself on its own premises."

This provision vests federal banking regulators with independent statutory authority to examine the operations of technology service providers to banks, without the need for any contractual provision granting such authority. The examination authority is coextensive with the regulator's authority over the bank itself — meaning that the OCC can examine Skybridge's services, records, systems, and facilities relating to the SkyComply™ platform with the same breadth and depth as if Meridian were performing those services internally.

Applicability to Skybridge. Skybridge, by providing the SkyComply™ AML and transaction-monitoring platform to Meridian (a national bank), qualifies as a "Bank Service Company" or "servicer" under the BSCA. The statute's definition of covered services is broad and encompasses technology services, data processing, internet banking services, and other activities commonly performed by fintech and enterprise software companies on behalf of insured depository institutions. There is no question that the services contemplated by the MSA fall within the scope of the BSCA.

Practical Implications for Skybridge. The BSCA examination authority has several practical implications for Skybridge in the context of the MSA:

• OCC Examination Authority. The OCC has independent statutory authority to examine Skybridge's services, records, systems, and facilities relating to the SkyComply™ platform as provided to Meridian. This authority exists regardless of whether the MSA contains a contractual provision granting such access. However, as discussed in Section V.A below, the MSA should explicitly acknowledge this examination authority for purposes of clarity, operational readiness, and consistency with regulatory expectations.

• Cooperation Obligations. Skybridge must cooperate with OCC examinations. While the BSCA does not prescribe specific cooperation requirements in granular detail, the practical expectation is that Skybridge will provide examiners with access to relevant records, systems, and facilities; make personnel available for interviews and information requests; and respond to examination requests in a timely and complete manner. Failure to cooperate with a regulatory examination could have serious consequences, including the potential for the regulator to issue an adverse finding or take enforcement action.

• Federal Reserve and FDIC Authority. In addition to the OCC's examination authority, the Federal Reserve and the FDIC also have examination authority under analogous provisions of the BSCA and the Federal Deposit Insurance Act. This is particularly relevant given that MFG (Meridian's holding company) is supervised by the Federal Reserve at the consolidated level and that Meridian is FDIC-insured.

• Examination Costs. The OCC may assess examination costs to the bank or the service provider. While the allocation of examination costs is typically addressed on a case-by-case basis, the MSA should be structured to ensure that Skybridge does not charge Meridian or the regulators for access provided in connection with regulatory examinations.

Skybridge's Existing Regulatory Examination Experience. It is worth noting that Skybridge currently serves over 60 banking and financial services clients, and it is therefore likely that Skybridge already has some experience with regulatory examinations under the BSCA. However, Skybridge should be prepared for the possibility of more intensive and more frequent examination activity in connection with the Meridian engagement, given Meridian's SIFI status and the enhanced regulatory scrutiny that accompanies that designation. SIFIs are subject to more rigorous and frequent examination cycles, and the OCC's examination of Meridian's third-party relationships — particularly those involving critical activities such as BSA/AML compliance — will be correspondingly more thorough. Skybridge should ensure that its internal compliance and examination-readiness programs are calibrated to meet these heightened expectations.

III. BSA/AML REGULATORY COMPLIANCE CONSIDERATIONS SPECIFIC TO SKYCOMPLY™

A. Nature of the SkyComply™ Platform

SkyComply™ is Skybridge's proprietary AI-driven anti-money-laundering and transaction-monitoring platform. It employs machine learning algorithms and rule-based logic to analyze transaction patterns, detect anomalies, and generate alerts for potential suspicious activity. The platform is designed to serve as the core technology infrastructure supporting a banking institution's BSA/AML compliance program, providing functionality across the full spectrum of BSA/AML compliance activities, including transaction monitoring, suspicious activity detection and alert generation, case management and investigation workflow, suspicious activity report ("SAR") filing support, currency transaction report ("CTR") reporting, customer due diligence ("CDD") and enhanced due diligence ("EDD") screening, beneficial ownership identification, and Office of Foreign Assets Control ("OFAC") sanctions screening.

Within Meridian's organizational structure, SkyComply™ will sit at the core of the bank's BSA/AML compliance program and will be used extensively by the Financial Crimes & Compliance ("FCC") division, led by Sandra Petrov, Meridian's Head of Financial Crimes & Compliance. Ms. Petrov is a key stakeholder in the MSA negotiations and has been actively involved in the technical evaluation and due diligence process. In addition to the FCC division, the platform will be used by compliance officers, branch managers, and designated personnel across Meridian's retail banking, commercial banking, and wealth management divisions — a user base of approximately 32,000 licensed individuals.

The SkyComply™ platform processes a wide range of data that is central to Meridian's BSA/AML compliance program, including but not limited to: (i) transaction data across all business lines and product types, including wire transfers, ACH transactions, check deposits, cash transactions, and securities trades; (ii) customer identification and verification data, including data collected pursuant to the Customer Identification Program ("CIP") requirements of Section 326 of the USA PATRIOT Act; (iii) CDD and EDD records, including beneficial ownership information; (iv) SAR-related data, including investigation files, supporting documentation, and filing records; (v) CTR data; and (vi) OFAC screening results and watchlist match data. Given the sensitivity and regulatory significance of this data, the SkyComply™ platform must be maintained in strict compliance with all applicable BSA/AML regulations, data protection requirements, and information security standards.

B. Regulatory Risk Profile

The regulatory risk profile associated with the SkyComply™ platform is exceptionally high, reflecting both the critical nature of BSA/AML compliance as a regulatory obligation and the potential consequences of any material deficiency in the platform's performance. Any material deficiency in SkyComply™ — including but not limited to system downtime affecting transaction monitoring coverage, inaccurate or incomplete transaction monitoring that fails to detect suspicious patterns, model risk issues in the AI-driven detection algorithms, data integrity problems that corrupt or lose transaction records, or configuration errors that result in false negatives — could directly and proximately result in one or more of the following adverse outcomes:

• BSA/AML Examination Findings or Matters Requiring Attention ("MRAs"). OCC examiners routinely assess the adequacy of a bank's BSA/AML compliance program during the examination cycle. If examiners determine that the SkyComply™ platform is not functioning adequately — for example, if it is failing to generate appropriate alerts, if its detection models are not properly calibrated, or if there are gaps in transaction monitoring coverage — the OCC could issue formal or informal examination findings, including MRAs that require Meridian to take corrective action within specified timeframes. MRAs are taken seriously by the banking industry and can be precursors to more severe enforcement actions if not adequately addressed.

• Consent Orders or Cease-and-Desist Actions. In more serious cases, the OCC or other regulators could issue formal enforcement orders, including consent orders or cease-and-desist orders, requiring Meridian to overhaul its BSA/AML compliance program, engage independent consultants, conduct lookback reviews, or take other remedial measures. Consent orders are public documents and can have significant reputational consequences in addition to their direct operational and financial impacts.

• Civil Money Penalties. Federal banking regulators have the authority to assess civil money penalties against banking organizations for BSA/AML violations. The amounts of such penalties can be substantial — in recent years, penalties assessed against major banking institutions for BSA/AML deficiencies have ranged from tens of millions to hundreds of millions of dollars, and in certain high-profile cases, penalties have exceeded $1 billion.

• Criminal Referrals. In extreme cases involving willful violations or facilitation of money laundering, regulators may make criminal referrals to the Department of Justice ("DOJ") or other law enforcement agencies. While criminal liability is typically directed at the bank and its officers rather than at the technology vendor, a material failure of the AML monitoring platform that facilitates criminal activity would have devastating consequences for all parties involved.

• Reputational Harm. BSA/AML enforcement actions are among the most high-profile regulatory events in the banking industry and attract significant media attention and market reaction. For a SIFI such as Meridian, the reputational consequences of a BSA/AML enforcement action — including potential impacts on customer confidence, counterparty relationships, and stock price — could be severe and long-lasting.

Given this risk profile, Meridian has a compelling regulatory and business interest in ensuring that the MSA provides robust contractual protections, performance standards, and compliance assurances with respect to the SkyComply™ platform. From Skybridge's perspective, it is equally important to understand that Meridian's demands for stringent contractual provisions in this area are driven not merely by commercial negotiating strategy but by genuine regulatory necessity.

C. Contractual Implications

The regulatory risk profile described above has several direct implications for the contractual provisions to be included in the MSA:

Representations and Warranties. Meridian will expect Skybridge to provide specific representations and warranties that the SkyComply™ platform performs materially in accordance with its documentation and specifications, and that the platform is designed and maintained to enable Meridian's compliance with applicable BSA/AML requirements. These representations should cover the platform's transaction monitoring capabilities, suspicious activity detection functionality, SAR and CTR reporting support, CDD and EDD features, and OFAC screening capabilities. Skybridge should also warrant that it will keep the platform current with evolving regulatory requirements, including updates in response to FinCEN advisories, FFIEC BSA/AML Examination Manual revisions, and other regulatory developments.

Regulatory-Driven Termination Right. Meridian will require a termination right that is triggered by a material regulatory finding against the SkyComply™ platform or the services provided by Skybridge under the MSA. Specifically, Meridian should have the right to terminate the MSA if a federal banking regulator (the OCC, the Federal Reserve, or the FDIC) issues a finding, order, directive, or recommendation that (i) requires Meridian to terminate or materially alter its relationship with Skybridge, or (ii) determines that the SkyComply™ platform is materially inadequate for BSA/AML compliance purposes. This termination right is essential from a regulatory compliance standpoint, as a bank cannot continue to rely on a technology platform that its regulators have determined to be deficient.

Indemnification. Skybridge's indemnification obligations under the MSA should cover third-party claims and losses arising from Skybridge's material breach of applicable law, including BSA/AML regulations. The scope and caps applicable to this indemnification obligation are discussed further in Section IV.G below and in the separate Indemnification and Liability Cap Analysis Memorandum.

Regulatory Notification Obligation. The MSA should include an affirmative obligation on the part of Skybridge to promptly notify Meridian of any regulatory inquiry, examination, or enforcement action directed at Skybridge that relates to, or could reasonably be expected to affect, the services provided under the MSA. This notification obligation is critical to Meridian's ability to manage its own regulatory risk and to respond appropriately to developments affecting its BSA/AML compliance infrastructure.

IV. REQUIRED CONTRACTUAL PROVISIONS — OCC AND INTERAGENCY GUIDANCE

This section discusses the specific contractual provisions that OCC Bulletin 2013-29 and the Interagency Guidance identify as essential components of contracts between banking organizations and third-party service providers, with particular emphasis on critical-activity relationships. For each category of provisions, this section describes the regulatory expectation, summarizes the current state of the MSA drafting, and provides a recommendation for further action. Recommended specific contract language is set forth in Section V.

A. Scope of Services and Performance Standards

Both OCC Bulletin 2013-29 and the Interagency Guidance emphasize the importance of clearly defining the scope of services to be performed by the third party and establishing measurable performance standards against which the third party's performance can be assessed. Ambiguity in the scope of services or the absence of meaningful performance metrics can leave the bank without adequate tools to monitor the third party's performance and enforce its obligations.

The MSA should include a clear and comprehensive description of the services to be performed by Skybridge, including the licensing and hosting of the SkyComply™ AML and transaction-monitoring platform, implementation and configuration services, ongoing managed support and maintenance, training for Meridian personnel, and any other ancillary services contemplated by the parties. The description should be sufficiently detailed to identify the specific capabilities and functionalities that Meridian requires and to delineate the respective responsibilities of the parties (e.g., Skybridge's responsibilities for platform availability and performance versus Meridian's responsibilities for data quality and system integration).

With respect to performance standards, the MSA should include measurable service level agreements ("SLAs") that define the minimum acceptable levels of platform performance. The current draft includes an SLA Exhibit (Exhibit A) that sets forth uptime targets, response time standards, and service credit mechanisms. The SLA framework should include clearly defined metrics (e.g., monthly uptime percentage, mean time to respond to critical incidents, mean time to resolution), specific thresholds for each metric, a tiered service credit mechanism that provides meaningful financial incentives for Skybridge to maintain performance at or above the specified levels, and escalation procedures for persistent performance failures.

Meridian must also retain the right to monitor Skybridge's performance on an ongoing basis, consistent with the Interagency Guidance's expectations for active oversight of critical-activity relationships. This monitoring right should encompass access to performance dashboards, regular performance reports, and the ability to conduct performance reviews at reasonable intervals.

B. Right to Audit

A cornerstone of regulatory compliance in the third-party risk management context is the bank's right to audit its third-party service providers. Both OCC Bulletin 2013-29 and the Interagency Guidance make clear that banking organizations must maintain contractual audit rights that enable them to assess the third party's performance, controls, and compliance with the terms of the agreement and applicable law.

Current MSA Draft. The current draft of the MSA provides that Meridian may audit Skybridge's security controls once per calendar year upon 30 business days' prior written notice. In lieu of a full on-site audit, Skybridge may satisfy Meridian's audit requests by providing its most recent SOC 2 Type II report (the most recent report was dated March 15, 2025, and was prepared by Crestfield Cyber Advisors, Inc.), its current ISO 27001 certificate (recertified January 22, 2025, by Crestfield Cyber Advisors, Inc.), and a supplemental Security Assessment Questionnaire completed by Skybridge. On-site audits are permitted only upon a demonstrated material security concern — meaning that Meridian must articulate a specific, credible basis for believing that on-site access is necessary before it can exercise that right.

Regulatory Assessment. This framework is generally acceptable from Skybridge's perspective, as it strikes a reasonable balance between Meridian's regulatory obligation to maintain audit rights and Skybridge's legitimate operational concerns about the frequency and burden of on-site audits. The SOC 2 Type II report and ISO 27001 certification, both prepared by a reputable third-party audit firm, provide meaningful assurance regarding the design and operating effectiveness of Skybridge's internal controls. The Security Assessment Questionnaire supplements these reports with Skybridge-specific information tailored to Meridian's risk assessment requirements.

Recommendation. However, the current draft has one significant gap that must be addressed: as currently drafted, Meridian's audit rights are limited to "security controls." This limitation is too narrow to satisfy the Interagency Guidance, which expects that the bank's audit rights will extend to all aspects of the third party's performance and compliance, not solely to information security matters. Specifically, the MSA must clearly state that Meridian's audit rights extend to all services, records, and facilities related to the MSA — encompassing performance against SLAs, compliance with contractual obligations, data handling practices, and any other aspect of Skybridge's operations that is relevant to the services provided to Meridian. This expansion of scope is necessary to ensure that Meridian's third-party risk management program satisfies the expectations of its examiners. While the SOC 2 Type II / ISO 27001 / questionnaire framework may continue to serve as the primary mechanism for exercising these rights in most circumstances, the contractual right itself must be broad enough to cover all relevant areas.

C. Regulator Examination Rights

The regulatory examination rights provision is arguably the single most critical regulatory compliance provision in the MSA. As discussed in Section II.C above, the BSCA grants federal banking regulators independent statutory authority to examine the operations of technology service providers to banks. This authority exists regardless of whether the MSA contains a contractual provision granting such access. Nonetheless, the MSA should explicitly acknowledge this examination authority for several important reasons:

• Clarity and Operational Readiness. An explicit contractual provision ensures that both parties — and their respective personnel — understand that regulatory examinations may occur and that cooperation is required. This is particularly important for Skybridge's operational and legal teams, who will need to have examination-readiness procedures in place.

• Regulatory Expectations. OCC examiners reviewing Meridian's third-party risk management practices will expect to see an explicit examination rights provision in the MSA. The absence of such a provision — even though the regulatory authority exists independently — could be cited as a deficiency in Meridian's contracting practices.

• Scope Confirmation. The contractual provision can confirm and clarify the scope of the examination right, including access to records, systems, facilities, and personnel, and can address practical matters such as cooperation obligations, cost allocation, and survival post-termination.

Key Elements of the Provision. The MSA must explicitly acknowledge that the OCC, the Federal Reserve, and the FDIC have the right to examine Skybridge's services, records, and facilities relating to the services provided to Meridian, in accordance with 12 U.S.C. § 1867(c) and applicable regulations. Skybridge must agree to cooperate fully with any such examination, including providing timely access to relevant records, systems, and facilities, and making knowledgeable personnel available for interviews and information requests. The MSA should state that this right exists independently of and in addition to Meridian's contractual audit rights, and that it survives the expiration or termination of the MSA to the extent required by applicable law or regulation. Critically, Skybridge cannot condition, limit, or restrict regulatory examination rights in any manner — these rights are statutory in nature and are not subject to contractual negotiation. The recommended specific language for this provision is set forth in Section V.A below.

D. Subcontractor / Subprocessor Management

The Interagency Guidance places significant emphasis on the risks that arise when a bank's third-party service provider relies on subcontractors or other fourth parties to perform some or all of the services provided to the bank. In such cases, the banking organization's risk exposure extends beyond the third party itself to encompass the subcontractor chain, and the bank's risk management practices must account for this extended exposure.

Skybridge's Use of Orion Cloud Services, Inc. Skybridge uses Orion Cloud Services, Inc. ("Orion Cloud") as its infrastructure-as-a-service ("IaaS") provider for hosting the SkyComply™ platform. Orion Cloud is a Delaware corporation headquartered at 4500 Great America Parkway, Santa Clara, California 95054. Orion Cloud provides the computing, storage, networking, and related infrastructure services upon which the SkyComply™ platform operates. Orion Cloud's platform SLA provides for 99.95% monthly uptime, which is consistent with industry standards for enterprise-grade cloud infrastructure. All Meridian data will be stored and processed within the continental United States only, utilizing Orion Cloud's US-East (Virginia) and US-West (Oregon) regions. This data residency arrangement is important for compliance with Meridian's data governance policies and applicable regulatory requirements regarding the geographic location of customer data.

Current MSA Draft. The MSA's Data Processing Addendum ("DPA"), set forth in Exhibit C, currently requires Skybridge to provide Meridian with 30 calendar days' advance written notice before engaging any new subprocessor that will handle Meridian data or have access to Meridian's confidential information. Meridian has a reasonable objection right during this 30-day notice period — meaning that Meridian may object to the proposed subprocessor on reasonable grounds, and Skybridge must work with Meridian to address the objection before proceeding.

Recommendation. The subcontractor management provisions should be strengthened in several respects to satisfy the Interagency Guidance's expectations. Specifically, the MSA and the Subprocessor Flow-Down Terms Addendum should obligate Skybridge to flow down all material regulatory compliance obligations to Orion Cloud and any other subcontractors handling Meridian data. This includes, at a minimum, data protection and information security requirements, business continuity and disaster recovery obligations, and confidentiality requirements. Most importantly, Meridian's contractual audit rights and the regulators' statutory examination rights must extend to subcontractors handling Meridian data. This can be accomplished through a combination of contractual flow-through provisions (requiring Skybridge to include corresponding provisions in its agreements with subcontractors) and direct access rights (granting Meridian and its regulators the right to audit and examine subcontractors directly, or through Skybridge as a conduit). The recommended specific language is set forth in Section V.E below.

E. Confidentiality and Data Protection

Given the volume and sensitivity of the data that SkyComply™ will process, robust confidentiality and data protection provisions are essential components of the MSA. The data processed by SkyComply™ — which includes transaction records, customer identification data, SAR-related information, and other BSA-regulated records — is classified as "Confidential" and "Highly Restricted" under Meridian's internal data classification policy. Much of this data constitutes NPI under the GLBA and PII under various federal and state data protection and breach notification statutes.

MSA Framework. The MSA addresses confidentiality and data protection through a multi-layered framework consisting of the confidentiality provisions in the body of the MSA, the Security Exhibit (Exhibit B), and the DPA (Exhibit C). The Security Exhibit establishes the minimum information security standards that Skybridge must maintain, including encryption requirements (AES-256 at rest and TLS 1.2 or higher in transit), access control requirements, vulnerability management and penetration testing obligations, and security monitoring and logging requirements. The DPA addresses data processing terms, subprocessor management, data retention and deletion, and data subject rights.

Security Incident Notification. One currently open negotiation point relates to the required timeframe for security incident notification. Skybridge has proposed a 24-hour notification window following discovery of a security incident affecting Meridian data. Meridian has demanded a 12-hour notification window. From a regulatory compliance standpoint, faster notification is preferable, as it better supports Meridian's own regulatory obligations to report security incidents to its regulators in a timely manner. The OCC expects national banks to have incident response plans that enable prompt notification to regulators, and a 12-hour notification window from Skybridge to Meridian would provide Meridian with more time to assess the incident and prepare its regulatory notification before applicable deadlines. While a 24-hour window is not uncommon in market practice, the 12-hour window is defensible and, given the sensitivity of the data involved and the regulatory context, may be the more prudent approach.

Background Checks. The MSA should require Skybridge to conduct background checks on all Skybridge personnel who will have access to Meridian data or Meridian systems, consistent with the FFIEC guidelines for technology service providers. Background checks should include, at a minimum, criminal history checks, employment verification, and credit checks, and should be conducted at the time of hiring and periodically thereafter.

Cross-Reference. A detailed analysis of the data security and privacy provisions of the MSA is provided in the separate Data Security and Privacy Requirements Memorandum, which addresses GLBA compliance, state data breach notification laws, encryption standards, incident notification requirements, and related matters.

F. Business Continuity and Disaster Recovery

The Interagency Guidance requires that contracts with critical third-party service providers address business continuity and disaster recovery in a manner that is commensurate with the criticality of the services being provided. For a platform as critical as SkyComply™ — which sits at the core of Meridian's BSA/AML compliance infrastructure — the business continuity and disaster recovery provisions must be robust and comprehensive.

The Interagency Guidance identifies several specific elements that should be addressed in the contract:

• Testing Requirements. The contract should require the third party to test its business continuity and disaster recovery plans on a regular basis (at least annually) and to provide the bank with the results of such tests. The bank should have the right to participate in or observe testing activities.

• Recovery Time Objectives and Recovery Point Objectives. The contract should define specific recovery time objectives ("RTOs") and recovery point objectives ("RPOs") for the services, reflecting the criticality of those services to the bank's operations. For a BSA/AML compliance platform serving a SIFI, the RTOs and RPOs should be aggressive — reflecting the reality that prolonged downtime or significant data loss in the transaction monitoring environment could have severe regulatory consequences.

• Notification in the Event of Business Disruption. The contract should require the third party to promptly notify the bank in the event of any business disruption that affects or could reasonably be expected to affect the services provided to the bank. The notification should include a description of the disruption, its anticipated impact, the steps being taken to remediate the disruption, and the estimated time to full recovery.

• Geographic Diversity. The contract should address the geographic diversity of data centers and infrastructure used to provide the services, to mitigate the risk of a single point of failure. In the case of Skybridge, this consideration is addressed by Orion Cloud's use of geographically separated US-East (Virginia) and US-West (Oregon) regions, which provides redundancy against regional outages and natural disasters.

Recommendation. The business continuity and disaster recovery provisions should be included in the Security Exhibit (Exhibit B) or as a separate schedule to the MSA. The provisions should define specific RTOs and RPOs, require annual testing with results shared with Meridian, establish notification requirements for business disruptions, and address Skybridge's obligation to maintain a current and documented business continuity plan. These provisions should be coordinated with the SLA Exhibit (Exhibit A) to ensure consistency between the uptime and availability commitments in the SLA and the recovery commitments in the business continuity provisions.

G. Indemnification and Liability

The Interagency Guidance notes that contracts with third-party service providers should address remedies available to the bank in the event of a breach or failure by the third party, including indemnification for losses caused by the third party's acts or omissions. The indemnification and liability provisions are among the most commercially significant and most heavily negotiated provisions in any enterprise SaaS agreement, and the Skybridge-Meridian MSA is no exception.

Current MSA Framework. The current MSA provides for mutual indemnification, with each party indemnifying the other against specified categories of claims and losses. Skybridge's indemnification obligations cover three principal categories:

• intellectual Property Infringement Claims. Skybridge indemnifies Meridian against third-party claims alleging that the SkyComply™ platform infringes the intellectual property rights of the third-party claimant. This indemnification is uncapped — meaning that there is no dollar limit on Skybridge's liability for IP infringement claims. This is consistent with market practice for enterprise SaaS agreements.

• Data Security Breaches. Skybridge indemnifies Meridian against losses arising from data security breaches attributable to Skybridge's failure to comply with its security obligations under the MSA. Skybridge has proposed capping this indemnification at 2× the annual fees (approximately $18,650,000). Meridian has demanded that this indemnification be uncapped.

• Material Breach of Applicable Law. Skybridge indemnifies Meridian against losses arising from Skybridge's material breach of applicable law, including GLBA and BSA/AML regulations. This indemnification is subject to the general indemnity cap of 1× the annual fees (approximately $9,325,000).

Aggregate Liability Cap. The MSA includes an aggregate liability cap — covering all claims of any nature arising under or in connection with the MSA — of 2× the annual fees, or approximately $18,650,000. This cap applies to all claims other than those specifically carved out (IP infringement, which is uncapped).

Data Security Super-Cap. In addition to the general aggregate liability cap, Skybridge has proposed a "super-cap" specifically applicable to data security breach claims of 3× the annual fees, or approximately $27,975,000. Meridian has demanded that data security breach liability be uncapped.

Regulatory Fines Carve-Out. A particularly significant negotiation point is Meridian's request to carve out regulatory fines and penalties from the MSA's exclusion of consequential, indirect, and special damages. Under the standard consequential damages exclusion, regulatory fines assessed against Meridian would likely be classified as consequential or indirect damages and would therefore be excluded from Skybridge's liability. Meridian's position is that regulatory fines directly resulting from Skybridge's breach of the MSA — particularly fines arising from BSA/AML deficiencies attributable to SkyComply™ — should be recoverable from Skybridge as direct damages or should be carved out from the consequential damages exclusion.

Regulatory Compliance Perspective. From a regulatory compliance perspective, the adequacy of the MSA's indemnification and liability provisions is a matter that OCC examiners will review in assessing Meridian's third-party risk management practices. Examiners will assess whether Meridian has negotiated contractual protections that provide meaningful recourse in the event of a third-party failure. Excessively low liability caps or overly broad limitations of liability that effectively insulate the third party from the consequences of its own breach — leaving Meridian without meaningful financial recourse — may be cited as examination findings or deficiencies in Meridian's third-party risk management program. The OCC does not prescribe specific dollar amounts or cap ratios, but examiners will assess the reasonableness of the provisions in light of the risk profile of the engagement, the criticality of the services, and the potential magnitude of losses.

Recommendation. The indemnification and liability provisions should be commercially reasonable and defensible to regulators. The specific cap levels and carve-outs are the subject of detailed analysis in the separate Indemnification and Liability Cap Analysis Memorandum, which assesses the proposed cap levels against market benchmarks, risk exposure analysis, and regulatory expectations.

H. Termination and Exit Strategy

Both OCC Bulletin 2013-29 and the Interagency Guidance require that contracts with critical third-party service providers include clear termination rights and exit strategies that enable the bank to transition away from the third party in an orderly manner if necessary. This requirement reflects the regulators' concern that banking organizations should not become so dependent on a single third-party service provider that they are unable to exit the relationship — or that the costs and disruption of doing so are prohibitively high — even when the relationship is no longer meeting the bank's needs or regulatory expectations.

Current MSA Provisions. The MSA provides for the following termination-related provisions:

• Initial Term. Five-year initial term commencing on the Platform Go-Live Date (targeted for March 1, 2026) and ending approximately February 28, 2031.

• Renewal Terms. Two successive one-year automatic renewal terms following the initial term, unless either party provides at least 180 calendar days' written notice of non-renewal prior to the expiration of the then-current term.

• Termination for Convenience. Meridian may terminate the MSA for convenience after Year 2 (i.e., after the second anniversary of the Platform Go-Live Date) upon 12 months' prior written notice and payment of an early termination fee ("ETF") equal to 50% of the remaining ACV for the balance of the initial term. For example, if Meridian terminates the MSA effective at the end of Year 3, the ETF would equal 50% × $9,325,000 × 2 remaining years = $9,325,000.

• Termination for SLA Failure. Meridian may terminate the MSA if the SkyComply™ platform's monthly uptime falls below 98.0% in three out of any six consecutive calendar months.

• Termination for Material Breach. Standard mutual termination rights for material breach, subject to cure periods.

• Regulatory-Driven Termination. Material regulatory finding against SkyComply™ as a potential termination trigger — this provision is to be included per the recommendation in Section V.B below.

Data Export and Destruction. Upon termination or expiration of the MSA, Skybridge is obligated to provide Meridian with a complete export of all Meridian data within 30 calendar days of the effective date of termination, in a machine-readable, industry-standard format. Following confirmation of Meridian's receipt of the exported data, Skybridge is required to certify the destruction of all Meridian data within 60 calendar days, subject to any applicable legal or regulatory retention obligations.

Source Code Escrow. As an additional element of exit protection, the parties have established a Source Code Escrow Agreement (Escrow Agreement No. SCE-2025-04417) with Sentinel Escrow Services, Inc. Under the escrow agreement, Skybridge has deposited the source code for the SkyComply™ platform with the escrow agent, and the source code will be released to Meridian upon the occurrence of specified release triggers, including: (i) the insolvency, bankruptcy, or dissolution of Skybridge; (ii) Skybridge's material breach of its support and maintenance obligations under the MSA that remains uncured for a period of 60 calendar days following written notice from Meridian; and (iii) cessation of Skybridge's business operations. The escrow arrangement provides Meridian with a measure of protection against the risk that Skybridge becomes unable or unwilling to continue supporting the SkyComply™ platform.

Recommendation. The termination and exit strategy provisions in the current

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP REGULATORY COMPLIANCE MEMORANDUM
TO: Amy Chesterton, Lead Associate; Angela Fontaine, Responsible Partner; Liam Prescott, Of Counsel
FROM: Nathan Ikeda, Working Associate
DATE: September 12, 2025
RE: Regulatory Compliance Analysis — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement (SkyComply™)
MATTER NO.: 1009-00007
STATUS: PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
The purpose of this memorandum is to analyze the regulatory framework applicable to Skybridge Fintech Ltd. ("Skybridge" or "SBF") as a technology service provider to Meridian National Bank, N.A. ("Meridian" or "MNB"), a national banking association chartered by the Office of the Comptroller of the Currency ("OCC") and further regulated by the Board of Governors of the Federal Reserve System (the "Federal Reserve") and the Federal Deposit Insurance Corporation (the "FDIC"). Meridian is a systemically important financial institution ("SIFI") with approximately $485 billion in total consolidated assets as of the most recently reported fiscal quarter, placing it well above the enhanced prudential standards thresholds established under Section 165 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, as amended. By virtue of its SIFI designation and the scope of its operations, Meridian is subject to heightened regulatory expectations across all dimensions of its risk management framework, including the management of third-party relationships.
Skybridge and Meridian are currently engaged in negotiations for a five-year enterprise Master Software-as-a-Service Agreement (the "MSA") covering the licensing, deployment, implementation, hosting, and ongoing support of SkyComply™, Skybridge's proprietary AI-driven anti-money-laundering and transaction-monitoring platform. The total contract value ("TCV") of the proposed engagement is approximately $50,000,000 over the initial five-year term, corresponding to an annual contract value ("ACV") of approximately $9,325,000 (inclusive of base license fees, implementation services, and managed support). The SkyComply™ platform is to be deployed across approximately 32,000 licensed users spanning Meridian's retail banking, commercial banking, and wealth management divisions. Given the scope and criticality of this deployment, the MSA represents one of the largest single-vendor technology engagements in Meridian's current procurement pipeline.
Meridian's holding company, Meridian Financial Group, Inc. ("MFG"), is a publicly traded bank holding company listed on the New York Stock Exchange. MFG is subject to Federal Reserve supervision and consolidated regulation, including capital planning, stress testing, and resolution planning requirements applicable to large banking organizations.
Skybridge is organized as a Delaware limited liability company (alternative entity structure) and is majority-owned — holding approximately 62% of the outstanding membership interests — by Pinnacle Ridge Capital Partners, LP, a Delaware limited partnership. Pinnacle Ridge is a mid-market private equity fund focused on financial technology and enterprise software investments. The remaining equity interests in Skybridge are held by its founders and certain members of the senior management team. Skybridge currently serves over 60 banking and financial services clients and holds current SOC 2 Type II and ISO 27001 certifications, as discussed in further detail below.
This memorandum identifies the key regulatory requirements that will shape the contractual provisions to be included in the MSA, specifically:
1. OCC Bulletin 2013-29, titled "Third-Party Relationships: Risk Management Guidance," which sets forth the OCC's supervisory expectations for national banks in managing risks associated with third-party relationships, including technology service providers;
2. The Interagency Guidance on Third-Party Relationships: Risk Management, jointly issued by the OCC, the Federal Reserve, and the FDIC in June 2023, which provides updated, consolidated guidance applicable to all supervised banking organizations;
3. The Bank Service Company Act, codified at 12 U.S.C. § 1861 et seq. (with particular emphasis on § 1867(c)), which grants federal banking regulators independent statutory authority to examine the operations of technology service providers that furnish services to insured depository institutions; and
4. BSA/AML regulatory considerations specific to the SkyComply™ platform, including the platform's role in supporting Meridian's compliance with the Bank Secrecy Act ("BSA"), as amended by the USA PATRIOT Act and the Anti-Money Laundering Act of 2020, and their implementing regulations, including the regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN") and the examination standards set forth in the Federal Financial Institutions Examination Council ("FFIEC") BSA/AML Examination Manual.
Recommended contract language for inclusion in the MSA is provided in Section V of this memorandum, and a consolidated summary of recommendations is set forth in Section VI. This memorandum should be read in conjunction with the related work product identified in Section VII, including the Indemnification and Liability Cap Analysis Memorandum, the Data Security and Privacy Requirements Memorandum, and the Insurance Coverage Gap Analysis Memorandum, each of which addresses specific aspects of the MSA in greater detail.
II. REGULATORY FRAMEWORK OVERVIEW
A. OCC Bulletin 2013-29: Third-Party Relationships — Risk Management Guidance
OCC Bulletin 2013-29, issued by the Office of the Comptroller of the Currency on October 30, 2013, establishes the OCC's comprehensive expectations for national banks and federal savings associations in managing the risks associated with third-party relationships. The Bulletin was issued against a backdrop of increasing reliance by banking organizations on external service providers for a wide range of operational, technological, and compliance-related functions, and it reflects the OCC's recognition that a bank's use of third parties does not diminish the bank's obligation to operate in a safe and sound manner and in compliance with applicable law.
Definition of "Third-Party Relationship." OCC Bulletin 2013-29 defines "third-party relationship" broadly to encompass "any business arrangement between a bank and another entity, by contract or otherwise." This definition is intentionally expansive and is not limited to traditional outsourcing arrangements. It specifically encompasses technology service providers, software-as-a-service vendors, cloud computing providers, data processors, payment processors, and any other entity that provides products or services to or on behalf of the bank. Under this definition, the proposed engagement between Meridian and Skybridge for the SkyComply™ platform clearly constitutes a third-party relationship subject to the Bulletin's requirements. There is no ambiguity on this point: Skybridge is an external technology service provider delivering a hosted software platform to a national bank, and the relationship is governed by a written contract (the MSA).
Classification of Relationships — "Critical Activities." The Bulletin classifies third-party relationships based on the criticality of the activities performed by the third party. Relationships involving "critical activities" are subject to the most rigorous risk management expectations. The Bulletin defines critical activities as those that:
• Could cause a bank to face significant risk if the third party fails to meet expectations;
• Have significant customer impacts;
• Require significant investment in resources to implement the activity or to transition the activity to another third party;
• Could have a major impact on bank operations if the bank needs to find an alternate third party or if the outsourced activity has to be brought in-house; or
• Involve services that the bank relies upon to comply with applicable laws and regulations.
The proposed Skybridge engagement unambiguously constitutes a "critical activity" relationship under these criteria. Specifically:
(a) BSA/AML Compliance Dependency. SkyComply™ directly supports Meridian's compliance with the Bank Secrecy Act and its implementing regulations, which are among the most significant regulatory obligations imposed on national banks. BSA/AML compliance is a core regulatory requirement, and deficiencies in a bank's AML program can result in enforcement actions, civil money penalties, criminal referrals, and reputational harm of the most severe kind. Meridian relies on SkyComply™ as the primary technology platform for transaction monitoring, suspicious activity detection, and related AML compliance functions. Accordingly, the platform falls squarely within the category of services that the bank "relies upon to comply with applicable laws and regulations."
(b) Processing of Non-Public Personal Information and Personally Identifiable Information. The SkyComply™ platform will process substantial volumes of Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. § 6801 et seq., and personally identifiable information ("PII") of Meridian's customers. This data includes transaction records, account information, customer identification data, and potentially sensitive information associated with suspicious activity investigations. The handling of such data implicates significant data security and privacy risks.
(c) Enterprise-Wide Deployment. The platform will be deployed to approximately 32,000 licensed users across all of Meridian's major business lines — retail banking, commercial banking, and wealth management. This enterprise-wide deployment means that the SkyComply™ platform will be deeply embedded in Meridian's operational infrastructure, and any material disruption or failure of the platform would have far-reaching consequences across the entire organization.
(d) Significant Financial Commitment. The total contract value of $50,000,000 over the initial five-year term represents a significant financial commitment by Meridian, further underscoring the critical nature of the relationship.
(e) Regulatory and Reputational Risk. Failure of the AML monitoring platform — whether due to system downtime, inaccurate transaction screening, failure to detect suspicious activity, or data integrity issues — could expose Meridian to enforcement action by the OCC, the Federal Reserve, the FDIC, or FinCEN; regulatory fines and penalties; and reputational harm that could materially affect Meridian's business, customer relationships, and standing in the financial services industry. Given Meridian's SIFI status and the heightened regulatory scrutiny that accompanies that designation, the consequences of a significant AML compliance failure would be particularly severe.
Key OCC Expectations for Critical-Activity Relationships. For third-party relationships involving critical activities, OCC Bulletin 2013-29 establishes the following expectations, each of which is relevant to the structuring and negotiation of the MSA:
• Comprehensive Due Diligence and Third-Party Selection. The bank should conduct thorough due diligence before entering into the relationship, assessing the third party's financial condition, business reputation, qualifications and experience, legal and regulatory compliance record, information security program, business continuity and disaster recovery capabilities, reliance on subcontractors, and insurance coverage. The due diligence process should be commensurate with the level of risk and complexity of the third-party relationship.
• Written Contracts with Specific Required Provisions. The bank should negotiate and execute written contracts that clearly define the rights and responsibilities of all parties. The Bulletin identifies specific provisions that should be included in contracts for critical-activity relationships, including scope of services, performance standards, audit and examination rights, data protection and confidentiality, business continuity and disaster recovery, subcontractor management, indemnification, termination rights, and dispute resolution. These required provisions are discussed in detail in Section IV of this memorandum.
• Ongoing Monitoring. The bank should conduct ongoing monitoring of the third party's performance, financial condition, and compliance with contractual terms and applicable law. Monitoring activities should include regular review of performance against service level agreements, assessment of the third party's financial statements and audit reports, and escalation of material issues to senior management or the board as appropriate.
• Contingency Planning and Exit Strategies. The bank should develop and maintain contingency plans for managing the relationship, including exit strategies that address how the bank would transition services to another provider or bring them in-house in the event of contract termination, third-party failure, or other disruption. The exit strategy should address data migration, transition services, and continuity of critical operations.
• Clear Governance and Escalation Procedures. The bank should establish clear governance structures, including designated relationship managers, regular performance reviews, and escalation procedures for addressing issues that arise during the course of the relationship. For critical-activity relationships, governance expectations are particularly robust and may include steering committees, executive-level oversight, and formal reporting to the board of directors.
• Board or Senior Management Oversight. The bank's board of directors or a designated committee thereof should provide oversight of the bank's third-party risk management program, including review and approval of critical third-party relationships. Senior management should be actively involved in the oversight of individual critical-activity relationships and should report to the board on the status and risks associated with such relationships on a regular basis.
Each of these expectations has direct implications for the structure and content of the MSA, and the recommendations set forth in Sections V and VI of this memorandum are designed to ensure that the MSA satisfies these expectations.
B. Interagency Guidance on Third-Party Relationships (June 2023)
In June 2023, the OCC, the Federal Reserve, and the FDIC jointly issued the Interagency Guidance on Third-Party Relationships: Risk Management (the "Interagency Guidance"). This guidance represents a significant milestone in the harmonization of supervisory expectations across the three principal federal banking agencies. The Interagency Guidance replaces or supplements prior individual agency guidance, including the OCC's Bulletin 2013-29 (which remains in effect for OCC-supervised institutions but is now read in conjunction with the Interagency Guidance), the Federal Reserve's SR 13-19, and the FDIC's Financial Institution Letter FIL-44-2008.
Applicability to Meridian. The Interagency Guidance applies to all banking organizations supervised by the three issuing agencies. Meridian, as a national bank chartered by the OCC, is directly subject to OCC supervision. MFG, as a bank holding company, is supervised by the Federal Reserve at the consolidated level. Meridian is also an FDIC-insured institution. Accordingly, the Interagency Guidance is directly applicable to Meridian's relationship with Skybridge from the perspective of all three agencies.
Alignment with OCC Bulletin 2013-29. The Interagency Guidance mirrors OCC Bulletin 2013-29 in many material respects. It adopts a similar risk-based approach, distinguishing between higher-risk and lower-risk third-party relationships and applying more rigorous expectations to the former. It addresses the same lifecycle stages of the third-party relationship — planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination — and sets forth substantially similar expectations for each stage. However, the Interagency Guidance also provides updated and, in some respects, expanded expectations that reflect the evolution of the third-party risk landscape since 2013, including the increased prevalence of cloud-based and AI-driven technology solutions.
Key Themes Relevant to the Skybridge Engagement. The following themes from the Interagency Guidance are particularly relevant to the negotiation and structuring of the MSA:
• Risk-Based Approach. The Interagency Guidance emphasizes that banking organizations should apply a risk-based approach to the management of third-party relationships, with more rigorous oversight for higher-risk relationships — particularly those involving critical activities. As established above, the Skybridge engagement is a critical-activity relationship by any measure, and Meridian's examiners will expect to see the full complement of risk management practices applied to this engagement.
• Due Diligence Standards. The Interagency Guidance provides detailed expectations for due diligence in connection with critical-activity relationships. Due diligence should assess, among other things, the third party's financial condition and viability, its legal and regulatory compliance history, its information security program and practices, its business continuity and disaster recovery capabilities, its reliance on subcontractors and fourth parties (including, in the case of Skybridge, its use of Orion Cloud Services, Inc. as its infrastructure-as-a-service provider), and the adequacy of its insurance coverage. The due diligence process should be documented and should inform the bank's risk assessment and contracting decisions.
• Contract Negotiation Requirements. The Interagency Guidance identifies specific provisions that banking organizations should seek to include in contracts with third-party service providers, particularly for critical-activity relationships. These provisions are substantially similar to those identified in OCC Bulletin 2013-29 and are discussed in detail in Section IV of this memorandum. Notably, the Interagency Guidance emphasizes that the contract should clearly articulate the bank's expectations and the third party's obligations with respect to audit and examination rights, data protection, incident notification, subcontractor management, business continuity, termination, and dispute resolution.
• Ongoing Monitoring Obligations. The Interagency Guidance requires banking organizations to conduct ongoing monitoring of third-party relationships commensurate with the level of risk. For critical-activity relationships, monitoring should include regular assessment of the third party's performance against agreed-upon service levels, review of audit reports (including SOC 2 Type II reports and ISO 27001 certifications), monitoring of the third party's financial condition, tracking of complaints and performance issues, and escalation of material concerns to senior management and the board. The Interagency Guidance also notes that banking organizations should periodically reassess the risk profile of their third-party relationships and adjust their oversight practices accordingly.
• Governance. The Interagency Guidance places significant emphasis on governance, requiring that the board of directors and senior management of the banking organization maintain appropriate oversight of the bank's third-party risk management program. For critical-activity relationships, this includes regular reporting to the board or a designated committee on the status of the relationship, material risks, and any significant issues that have arisen. The governance structure should include clearly defined roles and responsibilities, escalation procedures, and accountability mechanisms.
C. Bank Service Company Act (12 U.S.C. § 1867)
The Bank Service Company Act ("BSCA"), originally enacted in 1962 and subsequently amended, ensures that federal banking regulators retain full supervisory visibility over services performed for banks, even when those services are performed by entities outside the bank's own corporate structure. The BSCA was enacted in recognition of the fact that banks increasingly rely on external service providers for functions that are integral to banking operations, and that the delegation of these functions to third parties should not create gaps in regulatory oversight.
Statutory Framework. The key operative provision for purposes of the Skybridge engagement is Section 1867(c) of the BSCA, which provides that:
"The performance of [bank] services by [a third party] . . . shall be subject to regulation and examination by the appropriate Federal banking agency to the same extent as if such services were being performed by the [bank] itself on its own premises."
This provision vests federal banking regulators with independent statutory authority to examine the operations of technology service providers to banks, without the need for any contractual provision granting such authority. The examination authority is coextensive with the regulator's authority over the bank itself — meaning that the OCC can examine Skybridge's services, records, systems, and facilities relating to the SkyComply™ platform with the same breadth and depth as if Meridian were performing those services internally.
Applicability to Skybridge. Skybridge, by providing the SkyComply™ AML and transaction-monitoring platform to Meridian (a national bank), qualifies as a "Bank Service Company" or "servicer" under the BSCA. The statute's definition of covered services is broad and encompasses technology services, data processing, internet banking services, and other activities commonly performed by fintech and enterprise software companies on behalf of insured depository institutions. There is no question that the services contemplated by the MSA fall within the scope of the BSCA.
Practical Implications for Skybridge. The BSCA examination authority has several practical implications for Skybridge in the context of the MSA:
• OCC Examination Authority. The OCC has independent statutory authority to examine Skybridge's services, records, systems, and facilities relating to the SkyComply™ platform as provided to Meridian. This authority exists regardless of whether the MSA contains a contractual provision granting such access. However, as discussed in Section V.A below, the MSA should explicitly acknowledge this examination authority for purposes of clarity, operational readiness, and consistency with regulatory expectations.
• Cooperation Obligations. Skybridge must cooperate with OCC examinations. While the BSCA does not prescribe specific cooperation requirements in granular detail, the practical expectation is that Skybridge will provide examiners with access to relevant records, systems, and facilities; make personnel available for interviews and information requests; and respond to examination requests in a timely and complete manner. Failure to cooperate with a regulatory examination could have serious consequences, including the potential for the regulator to issue an adverse finding or take enforcement action.
• Federal Reserve and FDIC Authority. In addition to the OCC's examination authority, the Federal Reserve and the FDIC also have examination authority under analogous provisions of the BSCA and the Federal Deposit Insurance Act. This is particularly relevant given that MFG (Meridian's holding company) is supervised by the Federal Reserve at the consolidated level and that Meridian is FDIC-insured.
• Examination Costs. The OCC may assess examination costs to the bank or the service provider. While the allocation of examination costs is typically addressed on a case-by-case basis, the MSA should be structured to ensure that Skybridge does not charge Meridian or the regulators for access provided in connection with regulatory examinations.
Skybridge's Existing Regulatory Examination Experience. It is worth noting that Skybridge currently serves over 60 banking and financial services clients, and it is therefore likely that Skybridge already has some experience with regulatory examinations under the BSCA. However, Skybridge should be prepared for the possibility of more intensive and more frequent examination activity in connection with the Meridian engagement, given Meridian's SIFI status and the enhanced regulatory scrutiny that accompanies that designation. SIFIs are subject to more rigorous and frequent examination cycles, and the OCC's examination of Meridian's third-party relationships — particularly those involving critical activities such as BSA/AML compliance — will be correspondingly more thorough. Skybridge should ensure that its internal compliance and examination-readiness programs are calibrated to meet these heightened expectations.
III. BSA/AML REGULATORY COMPLIANCE CONSIDERATIONS SPECIFIC TO SKYCOMPLY™
A. Nature of the SkyComply™ Platform
SkyComply™ is Skybridge's proprietary AI-driven anti-money-laundering and transaction-monitoring platform. It employs machine learning algorithms and rule-based logic to analyze transaction patterns, detect anomalies, and generate alerts for potential suspicious activity. The platform is designed to serve as the core technology infrastructure supporting a banking institution's BSA/AML compliance program, providing functionality across the full spectrum of BSA/AML compliance activities, including transaction monitoring, suspicious activity detection and alert generation, case management and investigation workflow, suspicious activity report ("SAR") filing support, currency transaction report ("CTR") reporting, customer due diligence ("CDD") and enhanced due diligence ("EDD") screening, beneficial ownership identification, and Office of Foreign Assets Control ("OFAC") sanctions screening.
Within Meridian's organizational structure, SkyComply™ will sit at the core of the bank's BSA/AML compliance program and will be used extensively by the Financial Crimes & Compliance ("FCC") division, led by Sandra Petrov, Meridian's Head of Financial Crimes & Compliance. Ms. Petrov is a key stakeholder in the MSA negotiations and has been actively involved in the technical evaluation and due diligence process. In addition to the FCC division, the platform will be used by compliance officers, branch managers, and designated personnel across Meridian's retail banking, commercial banking, and wealth management divisions — a user base of approximately 32,000 licensed individuals.
The SkyComply™ platform processes a wide range of data that is central to Meridian's BSA/AML compliance program, including but not limited to: (i) transaction data across all business lines and product types, including wire transfers, ACH transactions, check deposits, cash transactions, and securities trades; (ii) customer identification and verification data, including data collected pursuant to the Customer Identification Program ("CIP") requirements of Section 326 of the USA PATRIOT Act; (iii) CDD and EDD records, including beneficial ownership information; (iv) SAR-related data, including investigation files, supporting documentation, and filing records; (v) CTR data; and (vi) OFAC screening results and watchlist match data. Given the sensitivity and regulatory significance of this data, the SkyComply™ platform must be maintained in strict compliance with all applicable BSA/AML regulations, data protection requirements, and information security standards.
B. Regulatory Risk Profile
The regulatory risk profile associated with the SkyComply™ platform is exceptionally high, reflecting both the critical nature of BSA/AML compliance as a regulatory obligation and the potential consequences of any material deficiency in the platform's performance. Any material deficiency in SkyComply™ — including but not limited to system downtime affecting transaction monitoring coverage, inaccurate or incomplete transaction monitoring that fails to detect suspicious patterns, model risk issues in the AI-driven detection algorithms, data integrity problems that corrupt or lose transaction records, or configuration errors that result in false negatives — could directly and proximately result in one or more of the following adverse outcomes:
• BSA/AML Examination Findings or Matters Requiring Attention ("MRAs"). OCC examiners routinely assess the adequacy of a bank's BSA/AML compliance program during the examination cycle. If examiners determine that the SkyComply™ platform is not functioning adequately — for example, if it is failing to generate appropriate alerts, if its detection models are not properly calibrated, or if there are gaps in transaction monitoring coverage — the OCC could issue formal or informal examination findings, including MRAs that require Meridian to take corrective action within specified timeframes. MRAs are taken seriously by the banking industry and can be precursors to more severe enforcement actions if not adequately addressed.
• Consent Orders or Cease-and-Desist Actions. In more serious cases, the OCC or other regulators could issue formal enforcement orders, including consent orders or cease-and-desist orders, requiring Meridian to overhaul its BSA/AML compliance program, engage independent consultants, conduct lookback reviews, or take other remedial measures. Consent orders are public documents and can have significant reputational consequences in addition to their direct operational and financial impacts.
• Civil Money Penalties. Federal banking regulators have the authority to assess civil money penalties against banking organizations for BSA/AML violations. The amounts of such penalties can be substantial — in recent years, penalties assessed against major banking institutions for BSA/AML deficiencies have ranged from tens of millions to hundreds of millions of dollars, and in certain high-profile cases, penalties have exceeded $1 billion.
• Criminal Referrals. In extreme cases involving willful violations or facilitation of money laundering, regulators may make criminal referrals to the Department of Justice ("DOJ") or other law enforcement agencies. While criminal liability is typically directed at the bank and its officers rather than at the technology vendor, a material failure of the AML monitoring platform that facilitates criminal activity would have devastating consequences for all parties involved.
• Reputational Harm. BSA/AML enforcement actions are among the most high-profile regulatory events in the banking industry and attract significant media attention and market reaction. For a SIFI such as Meridian, the reputational consequences of a BSA/AML enforcement action — including potential impacts on customer confidence, counterparty relationships, and stock price — could be severe and long-lasting.
Given this risk profile, Meridian has a compelling regulatory and business interest in ensuring that the MSA provides robust contractual protections, performance standards, and compliance assurances with respect to the SkyComply™ platform. From Skybridge's perspective, it is equally important to understand that Meridian's demands for stringent contractual provisions in this area are driven not merely by commercial negotiating strategy but by genuine regulatory necessity.
C. Contractual Implications
The regulatory risk profile described above has several direct implications for the contractual provisions to be included in the MSA:
Representations and Warranties. Meridian will expect Skybridge to provide specific representations and warranties that the SkyComply™ platform performs materially in accordance with its documentation and specifications, and that the platform is designed and maintained to enable Meridian's compliance with applicable BSA/AML requirements. These representations should cover the platform's transaction monitoring capabilities, suspicious activity detection functionality, SAR and CTR reporting support, CDD and EDD features, and OFAC screening capabilities. Skybridge should also warrant that it will keep the platform current with evolving regulatory requirements, including updates in response to FinCEN advisories, FFIEC BSA/AML Examination Manual revisions, and other regulatory developments.
Regulatory-Driven Termination Right. Meridian will require a termination right that is triggered by a material regulatory finding against the SkyComply™ platform or the services provided by Skybridge under the MSA. Specifically, Meridian should have the right to terminate the MSA if a federal banking regulator (the OCC, the Federal Reserve, or the FDIC) issues a finding, order, directive, or recommendation that (i) requires Meridian to terminate or materially alter its relationship with Skybridge, or (ii) determines that the SkyComply™ platform is materially inadequate for BSA/AML compliance purposes. This termination right is essential from a regulatory compliance standpoint, as a bank cannot continue to rely on a technology platform that its regulators have determined to be deficient.
Indemnification. Skybridge's indemnification obligations under the MSA should cover third-party claims and losses arising from Skybridge's material breach of applicable law, including BSA/AML regulations. The scope and caps applicable to this indemnification obligation are discussed further in Section IV.G below and in the separate Indemnification and Liability Cap Analysis Memorandum.
Regulatory Notification Obligation. The MSA should include an affirmative obligation on the part of Skybridge to promptly notify Meridian of any regulatory inquiry, examination, or enforcement action directed at Skybridge that relates to, or could reasonably be expected to affect, the services provided under the MSA. This notification obligation is critical to Meridian's ability to manage its own regulatory risk and to respond appropriately to developments affecting its BSA/AML compliance infrastructure.
IV. REQUIRED CONTRACTUAL PROVISIONS — OCC AND INTERAGENCY GUIDANCE
This section discusses the specific contractual provisions that OCC Bulletin 2013-29 and the Interagency Guidance identify as essential components of contracts between banking organizations and third-party service providers, with particular emphasis on critical-activity relationships. For each category of provisions, this section describes the regulatory expectation, summarizes the current state of the MSA drafting, and provides a recommendation for further action. Recommended specific contract language is set forth in Section V.
A. Scope of Services and Performance Standards
Both OCC Bulletin 2013-29 and the Interagency Guidance emphasize the importance of clearly defining the scope of services to be performed by the third party and establishing measurable performance standards against which the third party's performance can be assessed. Ambiguity in the scope of services or the absence of meaningful performance metrics can leave the bank without adequate tools to monitor the third party's performance and enforce its obligations.
The MSA should include a clear and comprehensive description of the services to be performed by Skybridge, including the licensing and hosting of the SkyComply™ AML and transaction-monitoring platform, implementation and configuration services, ongoing managed support and maintenance, training for Meridian personnel, and any other ancillary services contemplated by the parties. The description should be sufficiently detailed to identify the specific capabilities and functionalities that Meridian requires and to delineate the respective responsibilities of the parties (e.g., Skybridge's responsibilities for platform availability and performance versus Meridian's responsibilities for data quality and system integration).
With respect to performance standards, the MSA should include measurable service level agreements ("SLAs") that define the minimum acceptable levels of platform performance. The current draft includes an SLA Exhibit (Exhibit A) that sets forth uptime targets, response time standards, and service credit mechanisms. The SLA framework should include clearly defined metrics (e.g., monthly uptime percentage, mean time to respond to critical incidents, mean time to resolution), specific thresholds for each metric, a tiered service credit mechanism that provides meaningful financial incentives for Skybridge to maintain performance at or above the specified levels, and escalation procedures for persistent performance failures.
Meridian must also retain the right to monitor Skybridge's performance on an ongoing basis, consistent with the Interagency Guidance's expectations for active oversight of critical-activity relationships. This monitoring right should encompass access to performance dashboards, regular performance reports, and the ability to conduct performance reviews at reasonable intervals.
B. Right to Audit
A cornerstone of regulatory compliance in the third-party risk management context is the bank's right to audit its third-party service providers. Both OCC Bulletin 2013-29 and the Interagency Guidance make clear that banking organizations must maintain contractual audit rights that enable them to assess the third party's performance, controls, and compliance with the terms of the agreement and applicable law.
Current MSA Draft. The current draft of the MSA provides that Meridian may audit Skybridge's security controls once per calendar year upon 30 business days' prior written notice. In lieu of a full on-site audit, Skybridge may satisfy Meridian's audit requests by providing its most recent SOC 2 Type II report (the most recent report was dated March 15, 2025, and was prepared by Crestfield Cyber Advisors, Inc.), its current ISO 27001 certificate (recertified January 22, 2025, by Crestfield Cyber Advisors, Inc.), and a supplemental Security Assessment Questionnaire completed by Skybridge. On-site audits are permitted only upon a demonstrated material security concern — meaning that Meridian must articulate a specific, credible basis for believing that on-site access is necessary before it can exercise that right.
Regulatory Assessment. This framework is generally acceptable from Skybridge's perspective, as it strikes a reasonable balance between Meridian's regulatory obligation to maintain audit rights and Skybridge's legitimate operational concerns about the frequency and burden of on-site audits. The SOC 2 Type II report and ISO 27001 certification, both prepared by a reputable third-party audit firm, provide meaningful assurance regarding the design and operating effectiveness of Skybridge's internal controls. The Security Assessment Questionnaire supplements these reports with Skybridge-specific information tailored to Meridian's risk assessment requirements.
Recommendation. However, the current draft has one significant gap that must be addressed: as currently drafted, Meridian's audit rights are limited to "security controls." This limitation is too narrow to satisfy the Interagency Guidance, which expects that the bank's audit rights will extend to all aspects of the third party's performance and compliance, not solely to information security matters. Specifically, the MSA must clearly state that Meridian's audit rights extend to all services, records, and facilities related to the MSA — encompassing performance against SLAs, compliance with contractual obligations, data handling practices, and any other aspect of Skybridge's operations that is relevant to the services provided to Meridian. This expansion of scope is necessary to ensure that Meridian's third-party risk management program satisfies the expectations of its examiners. While the SOC 2 Type II / ISO 27001 / questionnaire framework may continue to serve as the primary mechanism for exercising these rights in most circumstances, the contractual right itself must be broad enough to cover all relevant areas.
C. Regulator Examination Rights
The regulatory examination rights provision is arguably the single most critical regulatory compliance provision in the MSA. As discussed in Section II.C above, the BSCA grants federal banking regulators independent statutory authority to examine the operations of technology service providers to banks. This authority exists regardless of whether the MSA contains a contractual provision granting such access. Nonetheless, the MSA should explicitly acknowledge this examination authority for several important reasons:
• Clarity and Operational Readiness. An explicit contractual provision ensures that both parties — and their respective personnel — understand that regulatory examinations may occur and that cooperation is required. This is particularly important for Skybridge's operational and legal teams, who will need to have examination-readiness procedures in place.
• Regulatory Expectations. OCC examiners reviewing Meridian's third-party risk management practices will expect to see an explicit examination rights provision in the MSA. The absence of such a provision — even though the regulatory authority exists independently — could be cited as a deficiency in Meridian's contracting practices.
• Scope Confirmation. The contractual provision can confirm and clarify the scope of the examination right, including access to records, systems, facilities, and personnel, and can address practical matters such as cooperation obligations, cost allocation, and survival post-termination.
Key Elements of the Provision. The MSA must explicitly acknowledge that the OCC, the Federal Reserve, and the FDIC have the right to examine Skybridge's services, records, and facilities relating to the services provided to Meridian, in accordance with 12 U.S.C. § 1867(c) and applicable regulations. Skybridge must agree to cooperate fully with any such examination, including providing timely access to relevant records, systems, and facilities, and making knowledgeable personnel available for interviews and information requests. The MSA should state that this right exists independently of and in addition to Meridian's contractual audit rights, and that it survives the expiration or termination of the MSA to the extent required by applicable law or regulation. Critically, Skybridge cannot condition, limit, or restrict regulatory examination rights in any manner — these rights are statutory in nature and are not subject to contractual negotiation. The recommended specific language for this provision is set forth in Section V.A below.
D. Subcontractor / Subprocessor Management
The Interagency Guidance places significant emphasis on the risks that arise when a bank's third-party service provider relies on subcontractors or other fourth parties to perform some or all of the services provided to the bank. In such cases, the banking organization's risk exposure extends beyond the third party itself to encompass the subcontractor chain, and the bank's risk management practices must account for this extended exposure.
Skybridge's Use of Orion Cloud Services, Inc. Skybridge uses Orion Cloud Services, Inc. ("Orion Cloud") as its infrastructure-as-a-service ("IaaS") provider for hosting the SkyComply™ platform. Orion Cloud is a Delaware corporation headquartered at 4500 Great America Parkway, Santa Clara, California 95054. Orion Cloud provides the computing, storage, networking, and related infrastructure services upon which the SkyComply™ platform operates. Orion Cloud's platform SLA provides for 99.95% monthly uptime, which is consistent with industry standards for enterprise-grade cloud infrastructure. All Meridian data will be stored and processed within the continental United States only, utilizing Orion Cloud's US-East (Virginia) and US-West (Oregon) regions. This data residency arrangement is important for compliance with Meridian's data governance policies and applicable regulatory requirements regarding the geographic location of customer data.
Current MSA Draft. The MSA's Data Processing Addendum ("DPA"), set forth in Exhibit C, currently requires Skybridge to provide Meridian with 30 calendar days' advance written notice before engaging any new subprocessor that will handle Meridian data or have access to Meridian's confidential information. Meridian has a reasonable objection right during this 30-day notice period — meaning that Meridian may object to the proposed subprocessor on reasonable grounds, and Skybridge must work with Meridian to address the objection before proceeding.
Recommendation. The subcontractor management provisions should be strengthened in several respects to satisfy the Interagency Guidance's expectations. Specifically, the MSA and the Subprocessor Flow-Down Terms Addendum should obligate Skybridge to flow down all material regulatory compliance obligations to Orion Cloud and any other subcontractors handling Meridian data. This includes, at a minimum, data protection and information security requirements, business continuity and disaster recovery obligations, and confidentiality requirements. Most importantly, Meridian's contractual audit rights and the regulators' statutory examination rights must extend to subcontractors handling Meridian data. This can be accomplished through a combination of contractual flow-through provisions (requiring Skybridge to include corresponding provisions in its agreements with subcontractors) and direct access rights (granting Meridian and its regulators the right to audit and examine subcontractors directly, or through Skybridge as a conduit). The recommended specific language is set forth in Section V.E below.
E. Confidentiality and Data Protection
Given the volume and sensitivity of the data that SkyComply™ will process, robust confidentiality and data protection provisions are essential components of the MSA. The data processed by SkyComply™ — which includes transaction records, customer identification data, SAR-related information, and other BSA-regulated records — is classified as "Confidential" and "Highly Restricted" under Meridian's internal data classification policy. Much of this data constitutes NPI under the GLBA and PII under various federal and state data protection and breach notification statutes.
MSA Framework. The MSA addresses confidentiality and data protection through a multi-layered framework consisting of the confidentiality provisions in the body of the MSA, the Security Exhibit (Exhibit B), and the DPA (Exhibit C). The Security Exhibit establishes the minimum information security standards that Skybridge must maintain, including encryption requirements (AES-256 at rest and TLS 1.2 or higher in transit), access control requirements, vulnerability management and penetration testing obligations, and security monitoring and logging requirements. The DPA addresses data processing terms, subprocessor management, data retention and deletion, and data subject rights.
Security Incident Notification. One currently open negotiation point relates to the required timeframe for security incident notification. Skybridge has proposed a 24-hour notification window following discovery of a security incident affecting Meridian data. Meridian has demanded a 12-hour notification window. From a regulatory compliance standpoint, faster notification is preferable, as it better supports Meridian's own regulatory obligations to report security incidents to its regulators in a timely manner. The OCC expects national banks to have incident response plans that enable prompt notification to regulators, and a 12-hour notification window from Skybridge to Meridian would provide Meridian with more time to assess the incident and prepare its regulatory notification before applicable deadlines. While a 24-hour window is not uncommon in market practice, the 12-hour window is defensible and, given the sensitivity of the data involved and the regulatory context, may be the more prudent approach.
Background Checks. The MSA should require Skybridge to conduct background checks on all Skybridge personnel who will have access to Meridian data or Meridian systems, consistent with the FFIEC guidelines for technology service providers. Background checks should include, at a minimum, criminal history checks, employment verification, and credit checks, and should be conducted at the time of hiring and periodically thereafter.
Cross-Reference. A detailed analysis of the data security and privacy provisions of the MSA is provided in the separate Data Security and Privacy Requirements Memorandum, which addresses GLBA compliance, state data breach notification laws, encryption standards, incident notification requirements, and related matters.
F. Business Continuity and Disaster Recovery
The Interagency Guidance requires that contracts with critical third-party service providers address business continuity and disaster recovery in a manner that is commensurate with the criticality of the services being provided. For a platform as critical as SkyComply™ — which sits at the core of Meridian's BSA/AML compliance infrastructure — the business continuity and disaster recovery provisions must be robust and comprehensive.
The Interagency Guidance identifies several specific elements that should be addressed in the contract:
• Testing Requirements. The contract should require the third party to test its business continuity and disaster recovery plans on a regular basis (at least annually) and to provide the bank with the results of such tests. The bank should have the right to participate in or observe testing activities.
• Recovery Time Objectives and Recovery Point Objectives. The contract should define specific recovery time objectives ("RTOs") and recovery point objectives ("RPOs") for the services, reflecting the criticality of those services to the bank's operations. For a BSA/AML compliance platform serving a SIFI, the RTOs and RPOs should be aggressive — reflecting the reality that prolonged downtime or significant data loss in the transaction monitoring environment could have severe regulatory consequences.
• Notification in the Event of Business Disruption. The contract should require the third party to promptly notify the bank in the event of any business disruption that affects or could reasonably be expected to affect the services provided to the bank. The notification should include a description of the disruption, its anticipated impact, the steps being taken to remediate the disruption, and the estimated time to full recovery.
• Geographic Diversity. The contract should address the geographic diversity of data centers and infrastructure used to provide the services, to mitigate the risk of a single point of failure. In the case of Skybridge, this consideration is addressed by Orion Cloud's use of geographically separated US-East (Virginia) and US-West (Oregon) regions, which provides redundancy against regional outages and natural disasters.
Recommendation. The business continuity and disaster recovery provisions should be included in the Security Exhibit (Exhibit B) or as a separate schedule to the MSA. The provisions should define specific RTOs and RPOs, require annual testing with results shared with Meridian, establish notification requirements for business disruptions, and address Skybridge's obligation to maintain a current and documented business continuity plan. These provisions should be coordinated with the SLA Exhibit (Exhibit A) to ensure consistency between the uptime and availability commitments in the SLA and the recovery commitments in the business continuity provisions.
G. Indemnification and Liability
The Interagency Guidance notes that contracts with third-party service providers should address remedies available to the bank in the event of a breach or failure by the third party, including indemnification for losses caused by the third party's acts or omissions. The indemnification and liability provisions are among the most commercially significant and most heavily negotiated provisions in any enterprise SaaS agreement, and the Skybridge-Meridian MSA is no exception.
Current MSA Framework. The current MSA provides for mutual indemnification, with each party indemnifying the other against specified categories of claims and losses. Skybridge's indemnification obligations cover three principal categories:
• intellectual Property Infringement Claims. Skybridge indemnifies Meridian against third-party claims alleging that the SkyComply™ platform infringes the intellectual property rights of the third-party claimant. This indemnification is uncapped — meaning that there is no dollar limit on Skybridge's liability for IP infringement claims. This is consistent with market practice for enterprise SaaS agreements.
• Data Security Breaches. Skybridge indemnifies Meridian against losses arising from data security breaches attributable to Skybridge's failure to comply with its security obligations under the MSA. Skybridge has proposed capping this indemnification at 2× the annual fees (approximately $18,650,000). Meridian has demanded that this indemnification be uncapped.
• Material Breach of Applicable Law. Skybridge indemnifies Meridian against losses arising from Skybridge's material breach of applicable law, including GLBA and BSA/AML regulations. This indemnification is subject to the general indemnity cap of 1× the annual fees (approximately $9,325,000).
Aggregate Liability Cap. The MSA includes an aggregate liability cap — covering all claims of any nature arising under or in connection with the MSA — of 2× the annual fees, or approximately $18,650,000. This cap applies to all claims other than those specifically carved out (IP infringement, which is uncapped).
Data Security Super-Cap. In addition to the general aggregate liability cap, Skybridge has proposed a "super-cap" specifically applicable to data security breach claims of 3× the annual fees, or approximately $27,975,000. Meridian has demanded that data security breach liability be uncapped.
Regulatory Fines Carve-Out. A particularly significant negotiation point is Meridian's request to carve out regulatory fines and penalties from the MSA's exclusion of consequential, indirect, and special damages. Under the standard consequential damages exclusion, regulatory fines assessed against Meridian would likely be classified as consequential or indirect damages and would therefore be excluded from Skybridge's liability. Meridian's position is that regulatory fines directly resulting from Skybridge's breach of the MSA — particularly fines arising from BSA/AML deficiencies attributable to SkyComply™ — should be recoverable from Skybridge as direct damages or should be carved out from the consequential damages exclusion.
Regulatory Compliance Perspective. From a regulatory compliance perspective, the adequacy of the MSA's indemnification and liability provisions is a matter that OCC examiners will review in assessing Meridian's third-party risk management practices. Examiners will assess whether Meridian has negotiated contractual protections that provide meaningful recourse in the event of a third-party failure. Excessively low liability caps or overly broad limitations of liability that effectively insulate the third party from the consequences of its own breach — leaving Meridian without meaningful financial recourse — may be cited as examination findings or deficiencies in Meridian's third-party risk management program. The OCC does not prescribe specific dollar amounts or cap ratios, but examiners will assess the reasonableness of the provisions in light of the risk profile of the engagement, the criticality of the services, and the potential magnitude of losses.
Recommendation. The indemnification and liability provisions should be commercially reasonable and defensible to regulators. The specific cap levels and carve-outs are the subject of detailed analysis in the separate Indemnification and Liability Cap Analysis Memorandum, which assesses the proposed cap levels against market benchmarks, risk exposure analysis, and regulatory expectations.
H. Termination and Exit Strategy
Both OCC Bulletin 2013-29 and the Interagency Guidance require that contracts with critical third-party service providers include clear termination rights and exit strategies that enable the bank to transition away from the third party in an orderly manner if necessary. This requirement reflects the regulators' concern that banking organizations should not become so dependent on a single third-party service provider that they are unable to exit the relationship — or that the costs and disruption of doing so are prohibitively high — even when the relationship is no longer meeting the bank's needs or regulatory expectations.
Current MSA Provisions. The MSA provides for the following termination-related provisions:
• Initial Term. Five-year initial term commencing on the Platform Go-Live Date (targeted for March 1, 2026) and ending approximately February 28, 2031.
• Renewal Terms. Two successive one-year automatic renewal terms following the initial term, unless either party provides at least 180 calendar days' written notice of non-renewal prior to the expiration of the then-current term.
• Termination for Convenience. Meridian may terminate the MSA for convenience after Year 2 (i.e., after the second anniversary of the Platform Go-Live Date) upon 12 months' prior written notice and payment of an early termination fee ("ETF") equal to 50% of the remaining ACV for the balance of the initial term. For example, if Meridian terminates the MSA effective at the end of Year 3, the ETF would equal 50% × $9,325,000 × 2 remaining years = $9,325,000.
• Termination for SLA Failure. Meridian may terminate the MSA if the SkyComply™ platform's monthly uptime falls below 98.0% in three out of any six consecutive calendar months.
• Termination for Material Breach. Standard mutual termination rights for material breach, subject to cure periods.
• Regulatory-Driven Termination. Material regulatory finding against SkyComply™ as a potential termination trigger — this provision is to be included per the recommendation in Section V.B below.
Data Export and Destruction. Upon termination or expiration of the MSA, Skybridge is obligated to provide Meridian with a complete export of all Meridian data within 30 calendar days of the effective date of termination, in a machine-readable, industry-standard format. Following confirmation of Meridian's receipt of the exported data, Skybridge is required to certify the destruction of all Meridian data within 60 calendar days, subject to any applicable legal or regulatory retention obligations.
Source Code Escrow. As an additional element of exit protection, the parties have established a Source Code Escrow Agreement (Escrow Agreement No. SCE-2025-04417) with Sentinel Escrow Services, Inc. Under the escrow agreement, Skybridge has deposited the source code for the SkyComply™ platform with the escrow agent, and the source code will be released to Meridian upon the occurrence of specified release triggers, including: (i) the insolvency, bankruptcy, or dissolution of Skybridge; (ii) Skybridge's material breach of its support and maintenance obligations under the MSA that remains uncured for a period of 60 calendar days following written notice from Meridian; and (iii) cessation of Skybridge's business operations. The escrow arrangement provides Meridian with a measure of protection against the risk that Skybridge becomes unable or unwilling to continue supporting the SkyComply™ platform.
Recommendation. The termination and exit strategy provisions in the current

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP REGULATORY COMPLIANCE MEMORANDUM

MATTER NO.: 1009-00007

I. EXECUTIVE SUMMARY

II. REGULATORY FRAMEWORK OVERVIEW

Record

Parties

Dates

Amounts